Sub-processors

Sub-processors (active)

Provider	Contracting entity (unverified unless stated)	What Memory uses	Personal data it receives	Purpose	Location	Transfer safeguard	Retention at the provider
Google Cloud	Google Cloud EMEA Limited (Ireland) for EEA customers [unverified for this billing account]	Cloud Run, Cloud SQL (PostgreSQL), Secret Manager, Cloud Logging, Artifact Registry, Identity-Aware Proxy (staff sign-in)	All data Memory stores: accounts, memories, chats, embed requests; request logs (IP address, user agent, URL); staff Google identities	Hosting, database, logs, staff sign-in	europe-west1 (Belgium) for services and database; logs in Google's `global` location; two database secrets use automatic replication; backups in Google's default backup location [unverified]	Google Cloud Data Processing Addendum with standard contractual clauses; Google LLC certified under the EU-US Data Privacy Framework [confirm for Logging]	Database: until Memory deletes, plus 14 daily backups and 7 days of recovery logs; request logs 30 days; administrative audit logs 400 days (fixed by Google); Google's deletion of covered data within a maximum of 180 days under its DPA
OpenAI	OpenAI Ireland Limited for EEA customers, per OpenAI's DPA [unverified for this account]	Responses API (`gpt-6-luna`) and embeddings (`text-embedding-3-small`)	Website page text (which can include names and contact details), review text for themes, chat questions with the passages found, business profile and SEO data needed for a task	Extraction, writing, strategy, website copy, chat answers and checks, search indexes	United States (global endpoint `api.openai.com`)	[unverified: standard contractual clauses in OpenAI's DPA; Data Privacy Framework certification not verified]	`store=false` on Responses calls; abuse monitoring up to 30 days by default; no training on API data unless opted in [verify account]
Apify	Apify Technologies s.r.o. (Czech Republic) [entity unverified]	Website Content Crawler (`apify~website-content-crawler`); Google Maps reviews (`compass~google-maps-reviews-scraper`); place search (`compass~crawler-google-places`)	Website address; the HTML and text of crawled pages; for reviews: business name, domain and country as search input, and review rating, text, date, language (reviewer personal data not requested)	Reading websites; Google reviews and place lookup	[unverified: Apify's infrastructure location]	[unverified: Apify DPA, said to cover customers automatically from 8 Jul 2026]	Review and place datasets deleted after capture. Crawled pages: deleted when the memory is deleted; proposal: deleted after capture [to approve; not automatic yet]
SE Ranking	[unverified]	SEO data API (`api.seranking.com`)	Domain, search country, keyword phrases derived from the website; normally no personal data	Search and AI-search measurements	[unverified]	[unverified]	[unverified]
Google Workspace (mail)	[unverified: Google Cloud EMEA Limited or Google Ireland Limited]	SMTP sending from a `sitemanager.io` mailbox	Recipient e-mail address, website host, message text; agency notices include the requester's e-mail	Service e-mails	[unverified: Workspace data location not verified]	As Google Cloud [verify]	Sent copies stay in the sending mailbox until deleted; proposal: 90 days [to approve; not automatic yet]

Providers not active for customer data

Provider	Status	Notes
Recurly	Inactive (`SMCA_PAYMENT_PROVIDER=none`)	When enabled: Recurly, Inc. [unverified]; receives payer name and card data entered in Recurly.js fields, invoices. API region setting defaults to `us`; must match SiteManager's Recurly site (EU option exists). Inventory its browser storage before enabling
Google Gemini API	Wired, not selected in production	Used locally by the developer's translation tool for UI strings only (no personal data). Before any customer data: paid tier, Gemini DPA, 55-day abuse retention
DataForSEO	Not used in production	Developer comparison tests only; planned as a company-data cross-check. Add here, with its DPA, before it receives production data
Notion	SiteManager's own projects only	Reads SiteManager's Agency Projects database for the internal workspace; never for agency or customer workspaces. Notion Labs, Inc. (United States) [unverified]. Not a sub-processor for agencies
SiteManager platform API	SiteManager's own platform	Receives approved case-study texts for SiteManager's own projects; not a third party
Cloudflare Turnstile	Proposed, not built	Would process visitor IP and browser signals on sign-up and embed forms; add here and to the cookie notice if built

Development and evaluation (not part of the service) [to approve]

Use	What it touches	Provider
Quality evaluation of chat answers	Frozen copies of selected production projects (pages, profiles, SEO data; review texts replaced); some snapshots also hold chat messages and sit on the developer's laptop	Judged by OpenAI (`gpt-6.1-sol`) and, for a secondary queue, Anthropic (Claude Opus) through the developer's tools
Code audits and fixes	Read-only queries on production data during audits	AI coding agents used by the developer (Anthropic, OpenAI)